Topic starter
06/07/2026 9:43 am
TL;DR: Identity attacks account for over 80% of breaches, and Lumos argues that visibility alone cannot keep pace with growing permission sprawl, delegated access, and AI agents that operate at machine speed. The harder problem is not seeing access, but deciding what matters and acting on it before over-privilege expands the blast radius.
Editorial analysis by NHI Mgmt Group, based on content published by Lumos: “Why Identity Needs Intelligence, Not Just Visibility”.
By the numbers:
- 80%+ of breaches involve identity attacks, which Lumos uses to frame identity as the weak link in modern security programmes.
- A 5,000-person company with 400 apps is managing hundreds of thousands of fine-grained permission and user combinations, according to Lumos.
Key questions
Q: How should IAM teams enforce least privilege when identity visibility is incomplete?
A: Start by using the access data you do have to rank permissions by likely risk and business criticality.
Q: Why do AI agents make excessive access more dangerous than human access?
A: AI agents can use inherited permissions continuously, across multiple systems, and at machine speed.
Q: What are the signs that traditional identity governance is not keeping up with access risk?
A: Traditional governance is lagging when it can only tell who has access, not whether that access is being used appropriately.
Practitioner guidance
- Prioritise access by risk, not volume Define which permissions, roles, and entitlements are most likely to expand blast radius, then route those for active remediation before lower-risk access is reviewed.
- Separate AI agent access from human access Create a distinct governance path for delegated permissions used by AI agents, including tighter scoping, explicit ownership, and different review triggers from human accounts.
- Build identity context into access decisions Connect role data, usage history, policy rules, and organisational relationships so reviewers and automated systems can judge whether access still fits current work.
Bottom line: Visibility without identity intelligence does not give IAM teams enough context to enforce least privilege at enterprise scale.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/07/2026 9:59 am
Identity intelligence is now the operational layer that least privilege was missing: visibility only answers what access exists, while intelligence answers which access matters enough to change. That distinction is what separates a reporting function from a governing function. Least privilege at enterprise scale depends on interpretation, prioritisation, and action, not on inventory alone.
A few things that frame the scale:
- Systems with least-privileged AI access had a 17% incident rate vs 76% for over-privileged systems. Organisations failing to scope AI access properly are 4.5x more likely to experience a security incident, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How can organizations effectively manage access delegation for AI agents?
A: Organizations can manage access delegation for AI agents by implementing policy-based authorization frameworks that ensure correct access levels are maintained. This also involves continuously monitoring agent activities to prevent overprivileged actions.
👉 Read our full editorial: Identity intelligence is becoming essential for least-privilege access